FR3110754A1 - Certification process, computer program and associated certification system - Google Patents

Abstract

Certification method, associated computer program and certification system Method for certifying (100) a planned trajectory of an aircraft, the method being implemented by a certification system remote from the aircraft, and comprising a step of: - reception (110) of the planned trajectory; - certification (120) of the planned trajectory according to at least one certification rule, to obtain a certified trajectory; - determination (130) of certification information relating to the certification of the planned trajectory, the certification information comprising at least one securing datum determined by a cyclic redundancy control technique of the certified trajectory; transmission to the aircraft of a first signal comprising the certification information, and of a second signal comprising the certified trajectory, the integrity of the certified trajectory included in the second signal being verifiable using the included security data in the certification information of the first signal. Figure for abstract: 2

Description

Certification process, computer program and associated certification system

The present invention relates to a method for certifying a planned trajectory of an aircraft.

The present invention also relates to an associated computer program and certification system.

The invention relates to the field of autonomous aircraft such as drones for example. These aircraft are for example configured to follow a trajectory in the absence of human intervention.

To obtain the right to fly in certain airspaces, certification of the trajectory followed by the aircraft is required.

Aircraft include, for example, on-board systems that are certified for controlling and tactically adapting the trajectory to be followed by the aircraft. Such systems are for example configured to avoid obstacles by modifying the trajectory during flight. The trajectory is thus certified on board by such on-board systems.

However, such on-board systems are complex and inflexible because they are generally permanently on-board in the aircraft and are constrained, for example, by the available space, the weight of the equipment and their performance.

An object of the present invention is thus to obtain a more flexible trajectory certification method, while guaranteeing the obtaining of the certified compliant trajectory.

To this end, the subject of the invention is a method for certifying a planned trajectory of an aircraft, the method being implemented by a certification system remote from the aircraft, and comprising a step of:

- reception of the planned trajectory;

- certification of the planned trajectory according to at least one certification rule, to obtain a certified trajectory;

- determination of certification information relating to the certification of the planned trajectory, the certification information comprising at least one securing datum determined by a cyclic redundancy check technique of the certified trajectory;

- transmission to the aircraft of a first signal comprising the certification information, and of a second signal comprising the certified trajectory, the integrity of the certified trajectory included in the second signal being verifiable by using the security data included in the certification information of the first signal.

The certification method makes it possible to obtain a more flexible certification of the trajectory, since the remote certification system of the aircraft is easily adaptable. The cyclic redundancy check technique of the certified trajectory makes it possible to guarantee that the certified trajectory received by the aircraft is indeed the trajectory certified compliant by the certification system.

According to other advantageous aspects of the invention, the certification process comprises one or more of the following characteristics, taken in isolation or in all technically possible combinations:

- during the transmission step, the first signal and/or the second signal is (are) transmitted by at least one encrypted link, preferably comprising an asymmetric encryption.

- a private key is recorded in the certification system to encrypt the first signal and/or the second signal, the first signal and/or second signal being decryptable by a public key recorded on board the aircraft.

- the certified trajectory comprises a plurality of data blocks, and during the step of determining the certification information, the security data is determined by determining, for each data block, a test value as a function of this data block, the securing data being a function of the test values.

- the test values are deterministic values.

- the method further comprises an error detection step, during which the certification system receives a third signal comprising an error message, the third signal being transmitted by the aircraft when the certified trajectory included in the second signal differs from the certified trajectory conforming to the certification information.

- the certification, determination and emission steps are implemented again following the error detection step.

- the method further comprises a step of selecting one or more processing modules, called active modules, to be used to certify the planned trajectory, from among a plurality of processing modules, each processing module being configured to certify a given trajectory according to at least one certification rule specific to this processing module, the certification step being implemented by the active module or modules.

The invention also relates to a computer program comprising software instructions which, when executed by a processor, implement a method as described above.

The invention further relates to a system for certifying a planned trajectory of an aircraft, comprising:

- a reception device configured to receive the planned trajectory;

- a processing device configured to certify the planned trajectory according to at least one certification rule, to obtain a certified trajectory, and configured to determine certification information relating to the certification of the planned trajectory, the certification information comprising at least security data determined by a cyclic redundancy check technique of the certified trajectory;

- a transmission device configured to transmit to the aircraft a first signal comprising the certification information, and a second signal comprising the certified trajectory, the integrity of the certified trajectory included in the second signal being verifiable by using the datum security included in the certification information of the first signal.

These characteristics and advantages of the invention will appear on reading the following description, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

- FIG. 1 is a schematic view of an aircraft and of a certification installation comprising a certification system according to the invention, and

- Figure 2 is a flowchart of a certification process implemented by the certification system of Figure 1.

In FIG. 1, an aircraft 2 and a certification installation 4 for the certification of a planned trajectory of the aircraft 2 are represented.

The aircraft 2 is for example an autonomous aircraft, configured to follow a trajectory in the absence of human intervention.

The aircraft 2 is for example unmanned, that is to say no passenger or pilot is likely to be on board. This is especially the case with a drone. In another example, aircraft 2 is manned, but by passengers who have no pilot qualifications.

According to a variant, the aircraft 2 is configured to be piloted or supervised by a remote pilot.

For example, the aircraft 2 comprises a short-term collision avoidance system, for example an impact warning and alarm system, also called the TAWS system (from the English “Terrain Awareness and Warning System”) ). According to another example, the short-term collision avoidance system is a “Detect and Avoid” type system also called DAA (from the English “Detect And Avoid”). The short-term collision avoidance system is configured to extrapolate a short-term trajectory along the axis of the aircraft 2 and to warn a piloting system of the aircraft 2 in the event of a risk of impact.

The aircraft 2 includes for example a determination system, not shown, configured to determine the planned trajectory. As a variant, the system for determining the planned trajectory is located outside the aircraft 2, for example arranged in a fixed manner on the ground, in particular remote from the certification installation 4.

The planned trajectory is for example a trajectory determined upstream of the flight of the aircraft 2, in particular when the aircraft 2 is on the ground.

The planned trajectory comprises in particular a take-off point, a landing point, and a flight part of the planned trajectory connecting the take-off point and the landing point. Thus, the planned trajectory is in particular a so-called “complete” trajectory, for example a planned trajectory of a mission of the aircraft 2.

Those skilled in the art will then understand that the planned trajectory differs from a so-called short-term trajectory corresponding to a trajectory comprising data over an interval of the order of a few seconds to a few minutes only.

The planned trajectory includes a plurality of parameters. For example, the trajectory comprises five parameters, namely three parameters relating to geographic coordinates, one parameter relating to time information and one parameter relating to a speed, in particular a speed at for each defined point of the planned trajectory.

The planned trajectory is for example formed by a plurality of data blocks. Each data block comprises for example one or more values of each parameter of the planned trajectory.

The certification installation 4 comprises a certification system 6 of the planned trajectory of the aircraft 2, a remote terminal 20, a reception antenna 16 and a transmission antenna 28.

The certification system 6 is remote from the aircraft 2. For example, the certification system 6 is located on the ground. For example, certification system 6 is integrated into a ground control center.

According to one example, the certification system 6 is implemented on a server, on a set of servers, or in a cloud.

The certification system 4 is configured to certify the planned trajectory. By this, it is understood that the certification system 4 is configured to verify the planned trajectory, and that the certification system 6 is a certified system, in particular according to a predefined standard.

The certification system 6 is for example certified in accordance with a standard of the DO-178C type, in particular the standard DO-178C/ED-12C, entitled “Software Considerations in Airborne Systems and Equipment Certification”, and accepted by the Radio Technical Commission for aeronautics, called "Radio Technical Commission for Aeronautics", in December 2011.

The certification system 6 is for example hosted on hardware that is also certified, for example in accordance with a standard of the DO-254 type.

The certification system 6 comprises a reception device 8, a processing device 10, a selection device 12 and an emission device 14.

The reception device 8, the processing device 10, the selection device 12 and the transmission device 14 are each, for example, integrated into at least one computer.

In this case, each of the devices among these devices is at least partially in the form of software executable by a processor and stored in a memory of the computer.

As a variant or in addition, each of these devices is integrated, at least partially, in a physical device, such as for example a programmable logic circuit, such as an FPGA (from the English “Field Programmable Gate Array”), or again in the form of a dedicated integrated circuit, such as an ASIC (from the English “Application Specific Integrated Circuit”).

The reception device 8 is configured to receive the planned trajectory, in particular via the reception antenna 16 connected to the reception device 8. Alternatively, the reception device 8 is configured to receive the planned trajectory via a cable connection.

The processing device 10 is configured to certify the planned trajectory according to at least one certification rule, to obtain a certified trajectory. By this, it is understood that the processing device 10 is a device certified to verify the planned trajectory.

The certified trajectory corresponds for example to the planned trajectory, certified by the certification system 6. In particular, the certified trajectory is the planned trajectory which is verified according to criteria predefined by the certification system 6.

The certified trajectory comprises for example, like the planned trajectory, a plurality of parameters. For example, the certified trajectory comprises five parameters, namely three parameters relating to geographic coordinates, one parameter relating to time information and one parameter relating to speed information.

The certified trajectory is for example formed by a plurality of data blocks. Each data block comprises for example one or more values of each parameter of the certified trajectory.

For example, the certified trajectory guarantees a DAL B criticality level according to the DO-178C type standard. According to another example, the certified trajectory guarantees a criticality level DAL A.

Furthermore, the processing device 10 is for example configured to determine certification information relating to the certification of the planned trajectory.

The certification information includes for example certification data indicating that the planned trajectory is a trajectory certified by the certification system 6.

The certification information further includes, for example, security data determined by a cyclic redundancy check technique of the certified trajectory, also called a CRC (Cyclic redundancy check) technique.

The security data makes it possible, for example, to verify error-free transmission of the certified trajectory.

The processing device 10 comprises a plurality of processing modules 18. Each processing module 18 is configured to certify a given trajectory according to at least one certification rule specific to this processing module 18. Each specific certification rule is in particular a rule predetermined.

The selection device 12 is configured to select one or more processing modules 18, called active modules, to be used to certify the planned trajectory. In particular, during the selection, only the active modules are used to certify the planned trajectory according to their specific certification rule, to obtain the certified trajectory.

According to one example, the certification information further comprises for example certification type data indicating the active module or modules used to certify the planned trajectory.

The selection of the active module(s) depends for example on the equipment on board the aircraft 2, on regulations from an authority of an airspace and/or on a mission of the aircraft 2.

By way of example, when the aircraft 2 comprises redundant position sensors, poor signal reception coverage from a satellite navigation system, such as GPS (Global Positioning System), is replaceable by other position sensors of the aircraft 2. In this example, the selection is likely not to include as active module a processing module 18 configured to certify a minimum coverage of a reception of GPS signals. Such a module is for example called module CGC_C below.

The remote terminal 20 is configured to receive choices from a user. To do this, the terminal 20 has for example a suitable man-machine interface which allows the user to make these choices. According to an exemplary embodiment, this interface makes it possible to represent the various processing modules 18 in a graphical and/or textual form so that the user can choose the necessary modules.

The remote terminal 20 is in particular remote from the certification system 6, and connected by a wired and/or wireless data link 22 to the certification system 6, in particular to the selection device 12.

The selection device 12 is in particular configured to select one or more active modules according to the user's choices made from the remote terminal 20.

The processing device 10 is for example configured to output the certification information.

In addition, the processing device 10 is configured to provide the certified trajectory, identical to the planned trajectory.

The transmission device 14 is configured to transmit one or more signals to the aircraft 2.

According to a first example, the transmission device 14 is configured to transmit the signal or signals directly to the aircraft 2, in particular by sending the antenna 28 to an antenna 26 of the aircraft 2.

According to a second example, the transmission device 14 is configured to transmit the signal(s) to the aircraft 2 via the remote terminal 20. In this case, the remote terminal 20 comprises an antenna 29 for receiving and issue. The remote terminal 20 is thus configured to receive, via the antenna 29, the signal or signals from the transmission device 14. The remote terminal 20 is for example configured to transmit, after a possible reception of a confirmation by the user , the signal(s) to the aircraft 2, via the antenna 29 or another means of transmission.

The transmission device 14 is for example configured to transmit to the aircraft 2 a first signal comprising the certification information relating to the certification of the trajectory planned by all the active modules.

The transmission device 14 is for example further configured to transmit to the aircraft 2 a second signal comprising the certified trajectory.

As a variant, the transmission device 14 is configured to transmit a signal comprising both the certification information and the certified trajectory.

According to one example, each input and each output of data from the certification system 6 comprises a dedicated firewall, not shown. This makes it possible to protect the certification system 6 and thus to guarantee the consistency of the calculations of the certification system 6.

An example of the processing device 10 is now described with reference to Figure 1.

The processing device 10 comprises for example nine processing modules 18. The processing modules 18 are for example called module WND_C, module CAG_C, module CFE_C, module TER_C, module ORA_C, module COR_C, module MOR_C, module CGC_C and module OTR_C.

Each processing module 18 is configured to certify a given trajectory according to at least one certification rule specific to this processing module 18. In particular, each certification rule makes it possible to verify the planned trajectory according to one or more predefined criteria. Each certification rule is implemented in particular according to the requirements of a standard, such as the standard type DO-178C.

Preferably, the specific certification rules are independent of each other. For example, a change in a certification rule specific to a processing module 18 has no impact on a certification rule specific to another processing module 18.

For example, each specific certification rule comprises the determination of the absence of conflicts between data of the planned trajectory and at least one condition specific to the processing module 18.

The specific condition of the module WND_C is for example the condition according to which the planned trajectory has a minimum margin to obstacles. The margin is a function of the wind around the planned trajectory at the time of flight of the planned trajectory, for example of the wind in a volume having a radius of 1 km around each point of the planned trajectory.

According to one example, the margin is also a function of the precision of the guidance systems of the aircraft 2 and of the navigation and positioning systems of the aircraft 2.

The WND_C module is thus configured to determine the minimum margin due to the wind and to check whether the planned trajectory has a distance greater than or equal to the minimum margin with respect to obstacles. The module WND_C is for example configured to receive as input meteorological data comprising wind forecasts at positions of the planned trajectory at the corresponding instants.

According to a preferred embodiment, the module WND_C is configured to receive as input a condition of maximum wind, the condition being used to determine beforehand a margin of the planned trajectory. The WND_C module is thus configured to compare said maximum wind condition with a maximum wind present at each point of the planned trajectory. When this maximum wind is less than or equal to said maximum wind condition, the WND_C module validates that the planned trajectory complies with the certification rule of the WND_C module, namely in particular that the determined margin of the trajectory is not exceeded .

The specific condition of the CAG_C module is the condition according to which the planned trajectory is confined in a cage, no position included in the cage overlapping with an obstacle or a prohibited zone.

The prohibited zone is for example a volume in an airspace subject to access restrictions. The cage has for example a parallelepipedal volume, the central point of which is the position of the trajectory at a given moment.

The specific condition of the CFE_C module is the condition according to which the planned trajectory is continuous. The continuity of the planned trajectory is a function of a calculation of the energy required to completely fly the planned trajectory. In particular, a planned trajectory is continuous when the aircraft 2 has the capacity to fly it completely.

The CFE_C module is thus configured to determine the energy required to completely fly the planned trajectory, for example by taking into account the time of the flight of the planned trajectory and the wind at the time of the flight at positions of the planned trajectory.

To verify the specific condition, the module CFE_C is for example configured to take account of the performance of the aircraft 2. The module CFE_C is for example configured to determine the energy available for the aircraft 2, for example from the quantity of fuel on board, ampere-hours or kilograms of hydrogen, and compare the energy available with the energy required. When the available energy is greater than or equal to the required energy, the CFE_C module then certifies the planned trajectory according to this specific certification rule.

The specific condition of the TER_C module is the condition according to which the planned trajectory has a minimum distance with respect to the terrain. For example, the TER_C module is configured to take field information from a field database as input. Each piece of terrain information is for example a point on the terrain comprising its altitude.

The specific condition of the MOR_C module is the condition according to which the planned trajectory has an altitude greater than a minimum threshold with respect to the terrain. For example, the MOR_C module is configured to only compare a vertical distance with the minimum threshold. Unlike the MOR_C module, the TER_C module is configured to compare distances of the planned trajectory relative to the terrain in any direction with a minimum distance.

Alternatively, the MOR_C and TER_C modules form a single module, configured to verify that the trajectory with its inaccuracies does not intercept the terrain, and/or that it is at a minimum altitude relative to the terrain.

The specific condition of the ORA_C module is the condition according to which the planned trajectory has a minimum distance in relation to obstacles and/or to zones of temporally restricted access.

The ORA_C module is for example configured to take into account the flight schedule of the planned trajectory, in order to take into account information on the presence of an obstacle in a given time interval or an access restriction to an area in a given time interval.

The specific condition of the COR_C module is the condition according to which the planned trajectory is included in a corridor defined around a predefined flight plan. For example, the COR_C module is configured to pre-check whether the planned trajectory satisfies conditions according to a performance-based navigation procedure or RNP (“Required Navigation Performance”).

A specific condition of the CGC_C module is for example the condition according to which the planned trajectory has a minimum coverage of a reception of signals from a satellite navigation system, such as for example GPS (from the English "Global Positioning System") , in particular for each position of the planned trajectory at the instants corresponding to these positions.

Another specific condition of the CGC_C module is for example the condition according to which the planned trajectory has a minimum communication coverage by mobile telephony or by satellite telephony, such as a communication according to the 3G, 4G, 5G or SatCom standards, in particular for each position of the planned trajectory at the instants corresponding to these positions.

The specific condition of the OTR_C module is the condition according to which the planned trajectory has a minimum distance with respect to other trajectories. For example, the OTR_C module is configured to receive trajectory data from other aircraft, for example from an unmanned aircraft systems traffic management system, not shown, and also called UTM system (from English “Unmanned aircraft system Traffic Management”).

The processing modules are thus configured to apply one or more of the specific rules to certify the planned trajectory.

For example, only part of the processing modules are configured to take time into account. In one example, only the WND_C, CFE_C, ORA_C and CGC_C modules are configured to take time into account.

According to one example, the certification system 6 further comprises a processing modification device 30, configured to add or remove at least one processing module independently of the operation of the other processing modules 18. This is illustrated in FIG. 1 , showing an example of adding a module 32 as a new processing module 18.

Each processing module 18 is for example configured to use external data relating to an external environment of the aircraft 2, from a certified database. “External environment” means a predefined volume around the aircraft 2 at each point of the planned trajectory, for example a spherical volume having a predefined radius, such as a radius of 10 km.

For example, each processing module 18 is configured to certify the planned trajectory as a function of at least one datum relating to the terrain, to obstacles, to zones of turbulence, to zones of temporally restricted access, to cover from reception of signals from a satellite navigation system, to communication coverage by mobile telephony or satellite telephony, and/or to trajectories of other aircraft.

For example, the processing device 10 comprises a plurality of databases, such as nine databases M1 to M9, in particular visible in the example of FIG. 1.

Each database is for example certified according to a standard of the RTCA DO-200A/ED-76 type. For example, each database complies with a standard such as DPAL 1 or DPAL 2 (from the English “Data Process Assurance Level”).

Each processing module 18 is configured to access one or more databases among the databases M1 to M9, as represented by arrows connecting the databases M1 to M9 with the respective processing modules 18.

According to one example, the database M1 includes wind data for the modules WND_C and CFE_C. The M2 database includes Aircraft 2 performance data for the WND_C and CFE_C modules. The M3 database includes field data for the CAG_C, TER_C and MOR_C modules. The M4 database includes data relating to restricted access areas for the CAG_C and ORA_C modules. The M5 database includes data relating to obstacles for the ORA_C module. The M6 database includes data on mobile volumes, for example areas with temporally restricted access for the ORA_C module. The M7 database includes signal coverage data from a satellite navigation system, and the M8 database includes mobile telephony or satellite telephony communication coverage data for the CGC_C module. The M9 database includes data relating to the trajectories of other aircraft for the OTR_C module. For example, the M9 database is configured to be fed by the UTM system.

A certification method 100 of the planned trajectory of the aircraft 2 is now described, with reference to FIG. 2 showing a flowchart of an example of the certification method 100. The certification method 100 is for example implemented by the certificate system 6.

The certification method 100 is in particular a method making it possible to verify the trajectory planned by the certification system 6.

The certification method 100 includes for example a reception step 110, a selection step 120, a certification step 130, a determination step 140, a transmission step 150 and an error detection step 160.

During the reception step 110, the reception device 8 receives the planned trajectory, for example by the reception antenna 16.

During the selection step 120, the selection device 12 selects one or more processing modules 18, called active modules, to be used to certify the planned trajectory, from among the plurality of processing modules 18. This step is implemented following the choices made by the user from the remote terminal 20.

During the certification step 130, the processing device 10 certifies the planned trajectory according to at least one certification rule, to obtain the certified trajectory.

In particular, each active module certifies the planned trajectory according to its corresponding specific certification rule.

During the determination step 140, the processing device 10 determines the certification information relating to the certification of the planned trajectory.

For example, the determination step 140 is implemented following the obtaining of the certified trajectory during the certification step.

For example, the processing device 10 determines, for each block of data of the certified trajectory, a test value as a function of this block of data.

For example, the test value is a sum of the values of the corresponding block. For example, a block of the certified trajectory comprises a plurality of data points, each data point having five values for corresponding parameters, such as latitude, longitude, altitude, time and an aircraft speed. The test value for a block of data comprises for example the sum of the values of each parameter, for each of the data points.

Alternatively, the test value includes only a portion of the data points.

The processing device 10 then determines the security datum as a function of the test values. For example, the security datum is the sum of the test values. The security data is thus determined by the CRC technique.

The test values are for example deterministic values. By “deterministic values”, it is understood in particular that these values are determined according to a predefined method.

During the transmission step 150, the transmission device 14 transmits to the aircraft 2 a first signal comprising the certification information, and a second signal comprising the certified trajectory.

According to a first example, the transmission device 14 transmits the first signal and the second signal directly to the aircraft 2, in particular by sending the antenna 28 to the antenna 26 of the aircraft 2.

According to a second example, the transmission device 14 transmits the signal or signals to the aircraft 2 via the remote terminal 20. In these cases, the remote terminal 20 receives the first signal and the second signal via the antenna 29, by example via a dedicated link, not shown, between the transmission device 14 and the remote terminal 20. For example, the user verifies the certified trajectory received. Following a command from the user, the remote terminal 20, or another dedicated transmission means, transmits the first signal and the second signal to the aircraft 2.

For example, the first signal or the second signal is transmitted by at least one encrypted link. According to a particular example, the first signal and also the second signal are transmitted by the encrypted link.

The encrypted link has for example an asymmetric encryption.

In particular, a private key is recorded in the certification system 6 to encrypt the first signal and/or the second signal. The first signal and/or second signal can be decrypted by a public key recorded on board the aircraft 2.

The fact that the private key is recorded in the certification system 6 facilitates the updating of this key, since it is more easily modifiable in a secure manner than the key recorded on board the aircraft 2.

According to one example, during the transmission step 150, the transmission device 14 transmits a certificate allowing the receiver, for example to the remote terminal 20 or to the aircraft 2, to verify that the first or second signal actually originates of the transmitting device 14.

When the first and the second signal are transmitted via the remote terminal 20 to the aircraft 2, the remote terminal 20 verifies, by means of a dedicated certificate, that it receives the first and second signal from the receiving device 14, and the aircraft 2 verifies, by means of another dedicated certificate, that it receives the first and second signal from the remote terminal 2.

The integrity of the certified trajectory included in the second signal can be verified, in particular by the aircraft 2, using the security datum included in the certification information of the first signal, by a corresponding determination according to the CRC technique.

For example, the aircraft 2 determines the security datum in the same way as that carried out during the determination step 140, from the certified trajectory received in the second signal.

Next, the aircraft 2 compares the security datum thus determined with the security datum received in the second signal. If the securing data are identical, then the aircraft 2 identifies that the certified trajectory has been transmitted without error.

If the aircraft 2 determines that the certified trajectory included in the second signal differs from the certified trajectory in accordance with the certification information, the error detection step 160 is implemented.

During the error detection step 160, the certification system 6 receives a third signal comprising an error message. The third signal is thus transmitted by the aircraft 2 when the certified trajectory included in the second signal differs from the certified trajectory in accordance with the certification information.

Upon receipt of the third signal, the certification system 6 implements the steps of certification 130, determination 140 and transmission 150 again following the error detection step 160. This is illustrated in particular in the example of figure 2 by an arrow R.

According to an example, the selection step 120 and the error detection step 160 are optional steps.

It is understood that the certification system 6 and the certification process 100 have a large number of advantages.

As the number and the type of processing modules 18 used for the certification of the planned trajectory are selectable, the certification system 6 makes it possible to easily adapt the certification of the planned trajectory according to the need of the operator of the aircraft 2 or according to restrictions in certain airspaces for example. This makes it possible to obtain a flexible certification, according to the needs, of the planned trajectory. In particular, a selection of the processing modules 18 as active modules during the selection step 120 makes it possible to easily adapt the operation of the certification system 6 according to the needs.

The certification method 100 also makes it possible to obtain a more flexible certification of the planned trajectory, because the certification system 6 remote from the aircraft 2 is easily adaptable by modifying the processing modules 18, in particular independently of one to the other.

In addition, for example, processing modules 18 unnecessary for the certification of a specific planned trajectory are not used as active modules. Thus, the certification system 6 makes it possible to obtain a simple and fast certification.

In addition, the cyclic redundancy check technique of the certified trajectory makes it possible to guarantee that the certified trajectory received by the aircraft 2 is indeed the trajectory certified as conforming by the certification system 6.

In addition, the verification of the trajectory planned by the certification system 6, accessible remotely by any user, allows each user, for example the operator of the aircraft 2, to obtain a verification of the trajectory planned by a certified system at a low cost, because the development and operating costs of the certification system 6 are shared by a large number of users.

Claims (10)

Method for certifying (100) a planned trajectory of an aircraft (2), the method being implemented by a certification system (6) remote from the aircraft (2), and comprising a step of:
- reception (110) of the planned trajectory;
- certification (120) of the planned trajectory according to at least one certification rule, to obtain a certified trajectory;
- determination (130) of certification information relating to the certification of the planned trajectory, the certification information comprising at least one securing datum determined by a cyclic redundancy check technique of the certified trajectory;
- transmission to the aircraft (2) of a first signal comprising the certification information, and of a second signal comprising the certified trajectory, the integrity of the certified trajectory included in the second signal being verifiable by using the datum security included in the certification information of the first signal. Method according to Claim 1, in which, during the transmission step (150), the first signal and/or the second signal is (are) transmitted by at least one encrypted link, preferably comprising asymmetric encryption. Method according to claim 2, in which a private key is stored in the certification system (6) to encrypt the first signal and/or the second signal, the first signal and/or second signal being decryptable by a public key stored on board of the aircraft (2). Method according to one of the preceding claims, in which the certified trajectory comprises a plurality of data blocks, and in which, during the step of determining (140) the certification information, the security data is determined by determination, for each block of data, of a test value as a function of this block of data, the security datum being a function of the test values. A method according to claim 4, wherein the test values are deterministic values. Method according to one of the preceding claims, further comprising an error detection step (160), during which the certification system (6) receives a third signal comprising an error message, the third signal being transmitted by the aircraft (2) when the certified trajectory included in the second signal differs from the certified trajectory in accordance with the certification information. A method according to claim 6, wherein the steps of certifying (130), determining (140) and issuing (150) are performed again following the step of detecting error (160). Method according to one of the preceding claims, further comprising a step of selecting (120) one or more processing modules (18), called active modules, to be used to certify the planned trajectory, from among a plurality of processing modules (18), each processing module (18) being configured to certify a given trajectory according to at least one certification rule specific to this processing module (18), the certification step (130) being implemented by the active modules. Computer program comprising software instructions which, when executed by a processor, implement a method according to one of the preceding claims. Certification system (6) of a planned trajectory of an aircraft (2), comprising:
- a receiving device (8) configured to receive the planned trajectory;
- a processing device (10) configured to certify the planned trajectory according to at least one certification rule, to obtain a certified trajectory, and configured to determine certification information relating to the certification of the planned trajectory, the certification information comprising at least one security datum determined by a cyclic redundancy check technique of the certified trajectory;
- a transmission device (14) configured to transmit to the aircraft (2) a first signal comprising the certification information, and a second signal comprising the certified trajectory, the integrity of the certified trajectory included in the second signal being verifiable by using the security datum included in the certification information of the first signal.